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Abstract 

This paper describes a model-predictive automatic recovery system for aircraft on the verge of a 
loss-of-control situation. The system determines when it must intervene to prevent an imminent accident, 
resulting from a poor approach. It estimates the altitude loss that would result from a go-around maneuver 
at the current flight condition. If the loss is projected to violate a minimum altitude threshold, the 
maneuver is automatically triggered. The system deactivates to allow landing once several criteria are 
met. Piloted flight simulator evaluation showed the system to provide effective envelope protection 
during extremely unsafe landing attempts. The results demonstrate how flight and propulsion control can 
be integrated to recover control of the vehicle automatically and prevent a potential catastrophe. 

Introduction 

On July 6, 2013, an Asiana Airlines Boeing 777 on final approach to San Francisco International 
Airport (SFO) came in too low and too slow. Shortly before reaching the runway threshold, the throttles 
moved forward (Ref. 1) to increase power and thus airspeed, possibly in an attempt to perform a go- 
around. However, before the additional power could have an effect, the aircraft pitched up and the tail 
section hit the seawall at the end of the runway. The impact broke off the empennage and landing gear, 
and the craft skidded, spinning and burning, down the runway. 

On this fateful flight, the aircraft was below glideslope and going too slowly during approach 
(Ref. 2). A common method of maintaining glideslope is for the pilot to manipulate pitch. Directed by the 
glideslope indicator, the pilot pulls the nose up if the craft is too low, and pushes the nose down if it is too 
high. Simultaneously, the pilot should be monitoring and maintaining airspeed by adjusting the throttle 
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(Ref. 3). Alternatively, the autothrottle can perform the latter function, if engaged. Sometimes, the pilot 
neglects airspeed for some reason (workload, distraction, concentration on maintaining glideslope, 
mistaken belief that the autothrottle is engaged, etc.) and lets airspeed get too low. In the case of Asiana 
Flight 214, there may have been some confusion about the autothrottle setting (Ref. 2), which could have 
been a contributing factor. If airspeed gets too low, it can be addressed automatically by an autothrottle 
“wake up” mode. This is a form of emergency protection that can activate to increase thrust when the 
plane is approaching stall speed (Ref. 4), but it is not available in all autoflight modes (Ref. 5). 

The glideslope itself is an approximately 3° path down to the ground, crossing the runway threshold at 
an altitude of about 50 ft before intersecting it at the aiming point 1000 ft further on. In a stabilized 
approach (Ref. 6), the plane generally flies down the glideslope at a relatively constant pitch; once it has 
passed the threshold and enters the ground effect, it flares to reduce sink rate and touches down. Rushed 
and unstabilized approaches are the largest contributing factor to approach and landing accidents. 
Continuing an unstabilized approach is a causal factor in 40 percent of all approach and landing accidents 
(Ref. 7). Combined, high and/or fast approaches and low and/or slow approaches are a causal factor in 
66 percent of such events (Ref. 7). 

The Asiana Airlines accident is currently under investigation and much is not known. It is known, 
however, that 8 sec prior to impact, the throttles began moving forward; at that time, altitude was below 
glideslope at 125 ft, and air speed was approximately 112 knots, well below the 137 knot reference 
landing speed. It is not known at the time of this writing whether the pilots moved the throttles manually, 
or if the autothrottle wake up mode had activated. In any case, at about 3 sec before impact, when the 
speed had dropped to 103 knots, the engines were only at about 50 percent power and increasing. By time 
of impact, airspeed had increased to about 106 knots (Ref. 1). 

Federal Aviation Administration (FAA) regulations require a time of not more than 5 sec to accelerate 
from 15 to 95 percent of takeoff power (Ref. 8). Furthermore, the thrust achieved after 8 sec from power 
application (starting from minimum flight idle) must allow a climb gradient of not less than 3.2 percent 
for go-around (Ref. 9). However, if the aircraft is descending, i.e., on approach, when the go-around 
maneuver is initiated, it will continue to experience an altitude loss before achieving this climb. 

Generally, the lower the initial airspeed and thrust, the greater the altitude loss and time required before 
si nk rate is reversed, especially when the aircraft is flying below approach speed and near idle power. 

Lack of thrust in particular is strongly correlated with altitude loss (Ref. 1 0). During an automatic go-around 
initiated at 50 ft, a Boeing 777 will lose approximately 30 ft of altitude (Ref. 4). If a go-around is required, 
the procedure given in the Boeing 777 Flight Crew Training Manual is to push the takeoff/go-around 
(TO/GA) switch, set flaps to 20°, apply go-around thrust, and rotate smoothly to 15° pitch attitude (Ref. 4). 

Deceleration to below final approach speed can be acceptable under certain circumstances, but 
throttles must be advanced to maximum thrust when initiating the go-around maneuver (Ref. 10). If an 
extremely low airspeed is achieved while the throttles are at idle, it may be the result of an unstabilized 
approach. If, in addition, the aircraft is close to the ground, as was the case with Asiana Flight 214, the 
altitude loss while the engines are spooling up can be catastrophic. 

The previously mentioned autothrottle wake up mode is part of a larger envelope protection scheme 
on the Boeing 777 and other aircraft. In general, the purpose of envelope protection is to keep the vehicle 
within its safe performance limits by inhibiting violations of parameters such as minimum and maximum 
operating speeds, bank angle, and aerodynamic forces. It deters the pilot from trying to operate outside of 
this safe range, although pilot override is possible (Ref. 11). Much of this envelope protection is 
accomplished automatically with the autopilot, and as with the autothrottle, it is not available in all flight 
modes (Ref. 5). This leads to the question of Asiana Flight 214 and the automation crack through which it 
fell. If no envelope protection was available, an unchecked confluence of events caused the aircraft to 
enter into a loss-of-control situation from which it could not recover. On the other hand, if the 
autothrottles woke up and advanced the throttles as the airspeed approached stall speed, it was already too 
late to save the plane given the altitude and engine spool-up time. 
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Figure 1. — Model-predictive automatic recovery system demonstrating altitude loss prediction. The green line 
indicates that the predicted altitude loss due to a go-around from high up on the glideslope will not cause a 
threshold violation. As the aircraft continues to descend and it approaches the altitude threshold, the 
prediction of altitude loss (red line) indicates a threshold violation will occur. 


This is one of several recent accidents that occurred on approach and resulted in fatalities. For some 
of them, investigations are ongoing and no cause has yet been determined, but there is speculation that 
pilot error could be to blame (Refs. 2, 12, and 13). Cases of unstabilized approaches and crash landings 
short of the runway have generated discussions about automation confusion and the erosion of piloting 
skills due to overreliance on automation (Ref. 14). These are training and human factors concerns that 
must be addressed, but ironically, some of the direst consequences of these automation-related problems 
can be prevented by adding another layer of automation (Ref. 15): a supervisory envelope protection 
scheme that anticipates loss-of-control accidents and intercedes to prevent them. 

The remainder of this paper describes a new model-predictive automatic recovery system that 
determines if the landing is salvageable. It gives the pilot the benefit of the doubt that he/she can land the 
aircraft safely until the last instant, at which time the system automatically takes over and initiates a go- 
around. The following sections describe the philosophy behind the design, which is followed by a 
description of the implementation approach. Then the test bed is described and examples of the system in 
operation are presented. This is followed by a discussion and conclusions. 


Philosophy of the Model-Predictive Automatic Recovery System 

The proposed model-predictive automatic recovery system looks ahead over a time horizon to 
ensure that the aircraft will not experience premature contact with the ground, and initiates an automatic 
go-around if necessary. It can be considered a very specialized integrated flight and propulsion control 
system, since it coordinates both the throttle and aircraft attitude commands for this single purpose. It is 
fully contained onboard the aircraft, with landing information available from sources such as an 
Instrument Landing System (ILS) or Global Positioning System (GPS). The functionality fits naturally 
within the envelope protection system of the aircraft, which imparts a design philosophy to it: it should 
not interfere with flight operation until the situation has reached the edge of becoming unrecoverable, at 
which point the system must recognize this and automatically recover from it; additionally, it must be 
able to be overridden for emergency landings, for instance. The system was designed with the assumption 
that the pilot intends to land the aircraft safely on the runway, and it determines whether this is possible. 
Its purpose is to prevent the aircraft from approaching too close to the ground unless it is near the runway 
and at an appropriate airspeed to avoid crashing. It does not require a stabilized approach; it gives the 
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pilot leeway to continue flying as long as an accident is not imminent. The system only reacts once it 
concludes that, without intervention, an accident will take place. Here an accident is defined as a situation 
in which, even if an immediate go-around is performed, the craft’s altitude will drop below a given 
threshold, when it is not over the runway. Because the system identifies the brink of when safe landings 
are no longer possible and there is no alternative but to go around, it can handle a variety of situations: 
low and slow, high and fast, stabilized descent short of the runway, and other conditions that have a very 
strong likelihood of disaster. 

The system predicts the altitude loss that would be sustained during an immediate go-around 
maneuver from the current flight conditions. If that altitude loss would result in the aircraft dipping below 
a given altitude threshold prior to reaching the runway, an immediate go-around is initiated. Otherwise, 
the flight continues on under pilot control and the altitude loss prediction is repeated at discrete intervals, 
as illustrated in Figure 1. The threshold is designed to provide a buffer to allow for prediction error, 
obstacles, etc., but be small enough that the airplane would never reasonably get that low under normal 
circumstances unless it is near the runway. The system turns off to enable landing when the flight path 
brings the craft near to and aligned with the runway and below a specified altitude (Fig. 2). At this point, 
it is assumed that the plane is positioned for the pilot to perform a safe landing. It is important to 
emphasize again that if this situation is realized, there has been no intervention and the pilot has 
performed a satisfactory approach; the system protects against dangerously unsatisfactory approaches, it 
does not make the approach better. Details of the system implementation are provided in the next section. 





♦ 



Figure 2. — Notional view of the aircraft passing through the altitude threshold (yellow line) to the runway. The 
overhead view (top) depicts the aircraft descending into the safe landing zone for the runway. Prediction of 
go-around induced altitude loss, designated by green lines along the glide path (bottom), turns off once the 
aircraft enters the runway area on a safe landing trajectory. This situation is indicated by the aircraft’s location 
within the safe landing zone without experiencing an altitude threshold violation. 
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Figure 3. — Flow chart of the model-predictive automatic recovery system. 
If the aircraft has not met the landing criteria, it predicts if the flight is 
about to become unrecoverable, and if so, triggers a go-around. 


Procedure 

The model-predictive automatic recovery system consists of three primary components: the flight and 
propulsion control override mode, the flight path predictor, and the trigger system. When activated, the 
override mode exerts full authority over the primary flight and propulsion controls in order to modify the 
flight trajectory and avoid ground contact. The flight path predictor detects the onset of unsafe operation 
(i.e., impending ground contact). The trigger system utilizes current and projected flight conditions to 
activate or disable the override mode (Fig. 3). This approach is conceptually similar to the Ground 
Collision Avoidance System (GCAS) developed for military aircraft. Both manually (Ref. 16) and 
automatically (Refs. 17 and 18) activated recovery systems have been previously investigated for military 
aircraft. Flowever, these systems are tailored towards the higher energy regime of the flight envelope. For 
civil transport applications, it is at least as important to focus on recovery from low-altitude, low-speed 
(e.g., approach) loss-of-control situations. 


Override Mode 

The Override (OR) Mode modifies the aircraft flight trajectory to avoid premature ground contact. 
Thus, the control mode is functionally similar to the go-around (GA) flight mode for modem transport 
aircraft. For this work, relatively simple control logic was developed for demonstration purposes, but a 
GA mode could alternatively be used, if available. Flere, pitch and roll control algorithms were utilized to 
build a control mode that executes a rudimentary GA maneuver. Specifically, when triggered, the OR 
Mode will: 


• Command full throttle 

• Manipulate elevator position to achieve approximately 15° nose-up pitch angle 

• Manipulate aileron position to achieve approximately 0° roll angle 

• Maintain aircraft configuration (i.e., flaps and landing gear are not retracted) 
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Figure 4. — Altitude loss during a go-around performed using the model-predictive automatic 
recovery system. The runs comprise various initial airspeeds and glide path angles; in all 
cases the throttle is at or near idle. True Air Speed, TAS, in knots, and sink rate in feet per 
minute at initiation are given for each case. The time to minimum altitude is approximately 
ordered by initial airspeed. At the longest, the minimum altitude occurred about five seconds 
after the maneuver was triggered. 

These characteristics are similar to those in a standard GA procedure (Ref. 4). In simulation testing, 
maintaining the flaps in landing configuration resulted in the smallest altitude loss. 

Additionally, simulation results from a variety of initial airspeeds and glide path angles with throttle 
at flight idle showed that the minimum altitude achieved before climb occurred less than 10 sec after 
initiation of the GA maneuver. Figure 4 demonstrates this for several examples of altitude loss with 
different initial airspeeds and sink rates. These results correspond well to the FAA time requirement for 
go-around climb (Ref. 9), suggesting that the OR Mode produces a reasonable representation of a 
standard GA maneuver. 


Flight Path Predictor 

The flight path predictor (FPP) is a simplified, two-dimensional, rigid-body physics model of the 
aircraft, used to determine the altitude loss that would result from a go-around maneuver. Lateral 
dynamics of the aircraft are neglected (i.e., constant heading, zero roll/sideslip, etc.) since the primary 
application considered for this work is the approach/landing phase. Wind is also neglected for simplicity. 
Thus, applying Euler’s Laws of Motion to the aircraft longitudinal characteristics yields the following 
equations of motion: 

F x =mV x 

F z = —mh 


M = ij 
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Assuming a Flat Earth inertial reference frame with the positive x-axis in the direction of aircraft 
heading and the positive z-axis pointing downward, the quantities in the equations are defined as: 

m aircraft mass 

Iyy aircraft pitching moment of inertia 
F x net force along the x-axis 
F- net force along the z-axis 
M net pitching moment 
V x air speed along the x-axis 
h altitude 
0 pitch angle 

The model accounts for longitudinal forces and moments due to aerodynamics and propulsion. The 
model assumes knowledge of the airframe aerodynamic characteristics due to angle of attack, Reynolds 
Number, and control surface deflections. Engine thrust is approximated as the response of a second-order 
dynamical system to throttle position input, which is a function of starting position (e.g., flight idle) and 
speed of engine response. Elence, once the physical characteristics of the airframe (mass, moment of 
inertia, etc.) and control parameters (control surface deflections and throttle) are specified, the system of 
equations is well-defined; all other relevant parameters (angle-of-attack, air speed, etc.) can be derived 
from the state variables. 

The previously described OR Mode control logic is applied to the simplified aircraft model in a 
closed-loop feedback configuration to provide the necessary control inputs (e.g., elevator deflection, 
throttle position, etc.). This interconnection represents the complete FPP architecture (Fig. 5). 



Initial Values of: 
Altitude (h) 
Air speed 
Flight path angle (Y) 
Vertical air speed (h) 
Pitch (0) 
Pitch rate (6) 
Flap position 
Throttle position 

Aircraft 

and 

Engines 


Figure 5. — Block diagram of the flight path predictor. The simplified model is initialized to the current flight 
condition. The go-around commands are applied and the maneuver is simulated over a 20 sec time horizon. The 
minimum altitude prediction is used to trigger the override mode, if necessary. This process is repeated as long 
as the override mode has not triggered and the trigger system has not deactivated. 


NAS A/TM— 20 14-216644 


7 


Trigger System 

The purpose of the trigger system is to determine if the OR Mode must be activated to avoid 
unintended ground contact. The trigger system queries the FPP at regular time intervals (once per second 
in this implementation) to obtain an estimate of the maximum altitude loss the aircraft would experience 
if it were to execute the full-throttle go-around maneuver implemented by the OR Mode. At each request, 
the FPP computes ahead 20 sec starting from the current measured flight conditions, using simulated 
flight and propulsion control inputs from the OR Mode. This time horizon is chosen to ensure the full 
altitude loss and recovery trajectory is captured. The FPP runs much faster than real-time; for this work, 
approximately 0.4 sec of computational time is required for the 20-sec time horizon. If the reported 
altitude loss will cause the aircraft to fly below a preset minimum altitude threshold, the OR Mode is 
activated, initiating the go-around and superseding pilot commands. To account for prediction errors, this 
minimum altitude threshold was chosen to be 50 ft above ground level everywhere except within a 
predetermined distance of the runway. 

To allow the aircraft to land, the trigger system deactivates the protection system if a set of conditions 
are satisfied. Assuming that the heading is correct for approach on the designated runway, the criteria are: 

• The aircraft is within about 1000 ft (horizontal distance) of the runway threshold. At this point, the 

FPP altitude threshold is set to zero 

• The aircraft is less than 50 ft above ground level 

If these conditions are met simultaneously without triggering a predicted trajectory violation from the 
FPP, the OR Mode is disabled, permitting the aircraft to touch down. 


Experimental Test Bed 

Piloted evaluation of the model-predictive automatic recovery system was performed in the NASA 
Glenn flight simulator. The aircraft model was the NASA-developed Transport Class Model (TCM) 

(Ref. 19), a generic, mid-sized, single-aisle transport aircraft with two wing-mounted engines. Two copies 
of the Commercial Modular Aero-Propulsion System Simulation 40k (C-MAPSS40k) (Refs. 20 to 21), 
the NASA-developed, 40,000-lb thrust class, high-bypass ratio turbofan engine model, represented the 
power plants. The closed-loop C-MAPSS40k engine meets the relevant FAA thrust response criterion, as 
shown in Figure 6. The C-MAPSS40k simulations were modified to include the detrimental effect of inlet 
distortion due to high angle of attack on engine thrust output, which can be significant in a loss-of-control 
event (Ref. 22). This combination of aircraft and engine models provides a realistic, nonlinear, full- 
envelope aircraft simulation. Furthermore, the cockpit has a reasonably comprehensive, fully configurable 
pilot interface, which delivers an immersive environment for highly representative testing and evaluation. 

Examples 

The experiments were based on situations that could lead to loss of control, such as the Asiana 
Airlines Flight 214 accident. Although the flight simulator models a different aircraft, the outcomes 
should be qualitatively similar. The demonstration flights were initiated at 3 nm out from SFO runway 
28L, lined up on the correct heading, airspeed of 135 kts, and 1000 ft above ground level (AGL) 

(Fig. 7). The stall speed of the TCM is about 100 kts. It has spoilers that can be used as speed brakes, 
although they were not for these experiments. The landing configuration is with the gear down and flaps 
fully extended. 
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Figure 6. — C-MAPSS40k Response to FAR 33.73b — Power or thrust response. Rise 
time requirement from not more than 1 5 percent of the takeoff thrust to 95 percent of 
the takeoff thrust in not over 5 sec. 



Figure 7. — Flight simulator test bed demonstrating approach into SFO Runway 28L. 
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AGL predicted 


1.5 


2.5 



Distance to Runway, nm 

Figure 8. — Example of stabilized approach showing altitude and the predicted 
minimum altitude due to a go-around, vertical speed, prediction of altitude 
loss, and throttle percent of full range. 

Several example flights were flown by the pilot from the starting point toward the runway. The pilot 
performed variations of regular landings from a stabilized approach, but also flew a stabilized approach 
on a glideslope with the aiming point short of the runway threshold, and various unstabilized approaches, 
coming in high and fast, and low and slow. A nominal run is illustrated in Figure 8; all variables are 
plotted versus distance from a safe landing spot just beyond the runway threshold, meaning that 
trajectory /time is shown from right to left. The top graph shows the altitude of the aircraft (solid blue line) 
along with the predicted minimum altitude that would result from initiating a go-around at each point 
along its flight path (red dashed line). The black dashed lines indicate the safe landing criteria: the 
horizontal line indicates the 50-ft altitude threshold, and the vertical line indicates the distance before the 
runway (about 1000 ft) where the altitude threshold drops to zero. As previously mentioned, the 
protection system is deactivated to allow landing once the aircraft is within 1 000 ft of the runway and 
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under 50 ft AGL with no predicted threshold violation. The point where this occurs is indicated by the 
blue circle. This is followed by a plot of vertical speed (sink rate), which is slightly faster than 
recommended for a stabilized approach (greater than 1000 ft per minute) (Ref. 6), but is not sufficient 
cause to reject the landing. The third plot down is the altitude loss prediction, which is repeatedly 
generated throughout the approach; the discretization is due to the relatively low frequency at which the 
FPP is executed (once per second). Note that the profile of the altitude loss prediction is quantitatively 
similar to that of vertical speed. This is not surprising since the aircraft generally requires more altitude to 
recover from higher sink rates. Finally, throttle position (percent of full range) is displayed (both throttles 
move together). 

Figure 9 depicts five failed approaches that were automatically rejected by the model-predictive 
automatic recovery system. The circle on each curve indicates the point at which the automatic go-around 
triggered, so for each variable shown for a specific run, the circles coincide. Flere again the top plot shows 
the aircraft’s altitude. On this plot it is clear that the prediction and go-around initiation system worked as 
it should, because the curves all come close to or dip below the threshold (the horizontal dashed line) and 
start increasing again, and all but the green line change direction in the vicinity of the threshold. The 
upper portion of Figure 1 0 zooms in on the section of this altitude plot where the flight path nears the 
altitude threshold. The lower part of Figure 10 shows the predicted threshold violation that initiated the 
go-around, again marked with a circle; note that although a threshold violation was predicted by the 
simplified model, the actual maneuver did not necessarily result in a violation. Continuing with Figure 9, 
the second plot down shows airspeed in knots, followed by vertical speed (sink rate) in feet per minute 
(third plot). The fourth plot shows pitch angle, and it is clear that after mode initiation, in all cases the 
pitch tends toward the 15° setpoint. The final plot shows throttle position, which goes to 100 percent 
immediately upon mode initiation. The five cases demonstrate the versatility as well as a limitation of the 
system. 

In the case of the blue curve, the aircraft came in high and fast. The top plot shows it continued at a 
nearly constant altitude until about 0.8 nm out, at which point it started to dive toward the runway. 
Airspeed and corresponding sink rate increased, as pitch angle dropped rapidly into the dive, until the 
automatic go-around initiated, the throttles went to 1 00 percent, and the nose pulled up sharply toward the 
15° commanded pitch. Because of the large sink rate, the OR Mode is triggered well above the altitude 
threshold. 

The red curve demonstrates a good, stabilized approach at an appropriate, consistent airspeed, but on 
a glide path that ends short of the runway. In this case, the pilot had opportunity to modify the glide path 
and head for the runway, but did not, which eventually triggered the system as the aircraft neared the 
altitude threshold. The magenta curve is similar to the red curve, but at a lower airspeed. Here too, the 
mode triggers very close to the altitude threshold. 

The cyan and green lines represent cases in which the airspeed drops dangerously low during the 
approach, similar to Asiana Flight 214. In these cases, because of the low airspeed, the mode is triggered 
further from the altitude threshold than in the two previous, more stabilized approaches. 

Interesting to note is that for the green curve, the aircraft comes relatively close to the ground before 
beginning to climb. This can be explained by the latency associated with the prediction mechanism. 

Recall that the FPP is executed once per second to predict a 20-sec time horizon; this frequency is about 
two orders of magnitude slower than that at which the propulsion and flight control systems operate. The 
circle on the green curves indicates where the mode was triggered, and on the pitch trace, the pilot 
commanded a sudden pitch down, with corresponding increase in sink rate, just prior to mode initiation. 
The pitch rate of change was relatively high compared to the update rate of the altitude loss estimation, 
overwhelming the ability of the protection system to “keep up” with the flight dynamics. Thus accurate 
prediction of the altitude loss can be thwarted by rapid aerodynamic changes that can occur during the 
update cycle of that calculation. 
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Figure 9. — Examples of failed approaches showing altitude, airspeed, 
vertical speed, pitch angle, and throttle percent of full range. The 
circle on each curve indicates the point at which the automatic 
go-around triggered. 
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Figure 10. — Detail of the initiation of the go-around maneuvers for the rejected 
approaches. The actual altitude is shown (top), along with the predicted altitude, 
showing the predicted threshold violations. Note that the prediction stops once 
the go-around is initiated. 

The current research implementation does not provide a way to disengage the Override Mode once it 
has been initiated; doing this correctly is a human factors issue. However, one can conceive of several 
reasonable approaches. For example, once a given climb rate or altitude is achieved, the autopilot could 
initiate an altitude and speed hold, at which point the pilot could retake control. 

Discussion 

The system was tested on a variety of acceptable stabilized approaches, as well as types of approaches 
that can lead to loss-of-control accidents. While the system worked as expected, several potential 
improvements were identified. The previously mentioned latency associated with the altitude loss 
estimate has the potential to cause significant underprediction. Speeding up the calculation cycle would 
help to eliminate this source of error. There is significant built-in margin here currently, with the 
estimation performed every second, while the 20-sec time horizon takes only about 0.4 sec to execute. 
Using an 8- to 10-sec time horizon with less idle time could reduce the cycle by about 80 percent. 

An integrated flight and propulsion approach was used to perform the go-around maneuver. The 
coordinated commands were based on documented procedures, but were developed outside of the existing 
flight control system for proof of concept. Utilizing an actual TO/GA mode might produce better results 
in terms of reducing altitude loss. 
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Figure 11. — Flight path of a successful landing showing altitude and predicted altitude 
loss versus distance from runway. Although this landing was acceptable, it nearly 
triggered a go-around. The blue circle indicates where the system disengaged to allow 
landing. 

On occasion, the fixed altitude threshold has caused the system to trigger on what appeared to be an 
acceptable flight path toward the runway. Figure 1 1 shows an example of an approach in which the 
prediction just missed touching the comer before the threshold dropped to zero; had the prediction 
dropped below 50 ft while the aircraft was still slightly farther than 1000 ft from the runway, the go- 
around would have triggered, even though it turned out to be a good landing. The location of this comer is 
the result of a trade-off between avoiding false alarms and minimizing the distance before the runway 
threshold that could be violated on a steep approach. A way to reduce the need to make this trade-off is to 
ramp the altitude threshold down to a point beyond the runway threshold. 

A related improvement involves accounting for the predicted go-around trajectory, as shown in 
Figure 2. While the altitude loss prediction is fundamental to the process and continuously updated, the 
aircraft’s corresponding forward movement, which is determined concurrently, is not used. This is 
inconsequential when the altitude threshold is of a fixed height, but not when it changes, e.g., the ramp 
proposed above, which varies with distance from the mnway. Projecting the altitude loss forward 
accounts for the threshold at the point where the minimum altitude would actually occur. The current 
approach effectively creates an artificial altitude buffer at the threshold lip because it simply subtracts the 
predicted altitude loss from the altitude at the present location; it does not project it forward. The 
predicted minimum altitude that just missed the threshold lip in Figure 1 1 would actually occur at some 
point ahead of the aircraft, where the threshold had already dropped to zero, so it would not come close to 
triggering a go-around. 

Areas that require further evaluation involve updates to the FPP that would be necessary for a real 
application. Currently, the FPP uses actual values of aircraft mass, moment of inertia, and aerodynamic 
forces available from the simulation. A more realistic implementation would require estimates of these 
values, which could lead to larger error in the predictions. 

Also, lateral dynamics of the aircraft are neglected in the model, although testing showed this did not 
add much uncertainty for the approach cases considered. 

Finally, wind is not accounted for in the prediction, which could have an effect on the prediction 
accuracy. Certainly, consideration of crosswinds would strengthen the need to incorporate some lateral 
control and dynamics parameters into the flight path prediction algorithm. 
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Conclusions 


A new model-predictive automatic recovery system, an envelope protection algorithm to help guard 
against unintended ground contact, has been proposed and demonstrated. It determines when ground 
contact is about to become inevitable, and at that point automatically initiates a go-around. The type of 
accidents it addresses are due primarily to pilot error, and it acts in a supervisory capacity to ensure that 
such concerns as confusion about the autopilot and autothrottle modes cannot result in loss of control. It 
provides a safeguard by overriding the flight and propulsion control commands once it determines that 
inaction will result in a crash. Piloted simulations demonstrated that the system worked as intended, 
allowing normal operation in all instances, but intervening consistently when an unrecoverable situation 
was imminent. A variety of unstabilized approaches were tested, as well as stabilized but otherwise 
deficient approaches. Analysis of these runs identified adjustments that could both reduce potential false 
alarms and reject marginally unacceptable landings. There is a fine line between acceptable and 
unacceptable landings, so making the decision to initiate a go-around in a borderline situation is difficult 
and requires some level of autonomy. Any adjustments that might result in an overall improvement rather 
than a tradeoff are very positive developments and should be investigated. Luckily the types of accidents 
addressed here are rare and the vast majority of landings are squarely in the acceptable range. However, 
in those rare cases in which some type of error on approach would normally result in premature ground 
contact, the model-predictive automatic recovery system has the potential to prevent the situation from 
turning deadly. 
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